96ba2119679f3a09985b523ea3e61df6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

96ba2119679f3a09985b523ea3e61df6_JaffaCakes118
Size

62KB
MD5

96ba2119679f3a09985b523ea3e61df6
SHA1

5981d6b07068f8f8590ee49b4175d568135b941c
SHA256

94f9e3d1a98bdc0bfb5b2c95b0755c9ef9003e69a70679acc18af77e81e14368
SHA512

808d9f5c3dd8e0e4b154b353c9ae4cdffcb436b30a67080d5ece80311b78955cc03d8ba392b324873b3b2862c6cf649fe4e63dedd809c1b60f866e931d05dfa4
SSDEEP

768:PQZJuMkT0DeHbcLqnfJrQLjP5wItxy0seOmNIRIbI7FMEAcCRSDqRO/XbFgyfA:P1gsLQLjP5Lxy0seOpIyvCRSWmFfA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96ba2119679f3a09985b523ea3e61df6_JaffaCakes118

Files

96ba2119679f3a09985b523ea3e61df6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

42fcfc09dcc55aaee17d3db1c2826558

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
ExitProcess
Sleep
GetVersion
CreateProcessA
CloseHandle
WriteFile
CreateFileA
lstrcpynA
CreateEventA
GetVersionExA
lstrcmpA
VirtualAlloc
VirtualFree
lstrcmpiA
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
GetSystemTime
MoveFileA
GetCurrentThreadId
WritePrivateProfileStringA
GetWindowsDirectoryA
MoveFileExA
GetTempPathA
CreateMutexA
GetTickCount
GetLocaleInfoA
GetVolumeInformationA
SetEvent
GetFileSize
SystemTimeToFileTime
GetProcessHeap
HeapFree
ReadFile
HeapAlloc
GetTempFileNameA
DeleteFileA
GlobalAlloc
VirtualQueryEx
GetThreadContext
GlobalFree
TerminateProcess
ResumeThread
RtlUnwind
VirtualQuery
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
OpenProcess
lstrcpyA
lstrlenA
lstrcatA
GetModuleHandleA
GetLastError
GetProcAddress
RaiseException
FindAtomA
ReleaseMutex
GetModuleFileNameA

user32

CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DefWindowProcA
GetWindowTextA
CloseDesktop
SetThreadDesktop
GetThreadDesktop
OpenInputDesktop
MessageBoxA
GetMessageA
SetWindowsHookExA
PostMessageA
FindWindowExA
GetWindowThreadProcessId
IsWindowVisible
GetCursorPos
wsprintfA
ClientToScreen
EqualRect
InflateRect
GetFocus
TranslateMessage
DispatchMessageA
CallNextHookEx
FindWindowA

advapi32

RegCloseKey
RegDeleteValueA
RegEnumValueA
RegDeleteKeyA
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
OpenProcessToken
CreateProcessAsUserA
RegCreateKeyExA

shlwapi

SHDeleteValueA
SHGetValueA
SHSetValueA
SHDeleteKeyA

Exports

Exports

PvwfXT
VLfMTKQFAbmU
mdXfyCG
ptnxRO
ukLkzP

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42fcfc09dcc55aaee17d3db1c2826558

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 13KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 13KB

.reloc
Size: 3KB - Virtual size: 2KB